Approved changes feed: RSS · Atom
cpe:2.3:a:lollms:lollms:9.6:*:*:*:*:*:*:*
part: a version: 9.6 update: *
| Vendor | Lollms (c462c41a-51fb-579f-8ef2-5b37366b074d) |
|---|---|
| Product | Lollms (89677724-5f1c-5bd6-a62c-bb822e358b46) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-4499 |
vulnerable | 2026-06-08 06:50:17.866182 |
CSRF Vulnerability in parisneo/lollms XTTS Server
HIGH (7.6)
A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.
Published: 2024-06-24T03:06:46.088Z
Updated: 2024-08-01T20:40:47.283Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.